Primary Market Research Summary Risk Management. Evrim Numanoglu Ozgen. August - October Primary Market Research Summary Risk Management

Size: px

Start display at page:

Download "Primary Market Research Summary Risk Management. Evrim Numanoglu Ozgen. August - October Primary Market Research Summary Risk Management"

Madison Dean
7 years ago
Views:

1 Primary Market Research Summary Risk Management August - October

2 Introduction This paper is summary of the primary research study done for a customer driven fesibility study as part of the Entrepreneurship Summer School Course at London Business School. The objective of the primary research was to identify challenges that organizations tackle when performing risk management. Interviews have been conducted with 20 managers in 20 organizations. The managers who have been interviewed are in charge of performing and managing risk management activities in their organizations. The industries covered by the primary research are insurance, management consultancy, telecommunication, energy, recruitment, data storage, IT service management and SaaS. Findings Risk Types Organizations manage different types of risk depending on their goals, organizational structures and industries they operate in. Following risk types are managed with structured methodologies and resources by the organizations interviewed during the primary research. Investment Risk Operational Risk Market Risk Financial Risk Information Security Risk Business Continuity Risk Insurance Risk Reputational Risk Supplier Risk 2

3 Challenges Siloed Approach: Most of the organizations manage more than one type of risk. General practice is to use different methodologies and to employ separate organizational functions to manage different risk types. This leads to silos in the organizations and therefore to inefficient communication, inefficient resource management and poor risk management performance. Administration: Most of the organizations stated that risk management activities require considerable administration time. Key activities that the organizations invest most of the administration time are data collection, data input, reporting and document control. Lack of automation in processes has been indicated as one of the root causes for heavy administration. Interpretation of Risk: Every organization has a different structure, different strategy and different culture. Therefore, interpretation of risk changes depending on industry, organization and business function. This creates challenges for risk managers. Complexity: Risk management is a complicated topic for people whose jobs are not specifically related to risk management. Instead of daily business language technical terms are used in risk management. Further, many software tools used for risk management are not easy to implement and to use. This creates barriers to involve people in risk management and to raise awareness about risk management. People Management: Implementing a good risk management practice usually requires changes in processes and most importantly in thinking of people. Embedding risk management into an organization requires embedding it into the culture of that organization. This leads to a challenge which is overcoming the resistance to the change. Box Ticking: Some of the organizations that were interviewed stated that risk management was considered as ticking few boxes in checklists rather than a value adding activity by other functions in their organizations. Continuity: When risk management is implemented because of some external requirements such as customer request or legal requirements, continuity of risk management becomes an issue. Because the risk management activities in those circumstances are completed only to satisfy external needs. It makes the risk management costly to maintain. Moreover, it becomes difficult for organizations to get the return from their risk management investments. 3

4 Changing Environment: Internal and external changes happen often in today s business world. This makes risk management even more important than ever. However, challenge is how to cope with ongoing changes and integrate them into risk management practices continuously. Results of yesterday s risk assessment might be irrelevant today. Generic Suggestions: A systematic approach should be used for risk management. Risk management can be a success when it is part of the business management system in the organizations. Risk management should be dynamic and proactive in order to meet needs of changing business environment. Risk modelling methodologies can be used to analyse changes and create options as output. Success of risk management should be measured. Therefore objectives and key performance indicators for risk management system should be identified. Entire risk management system should be monitored regularly. Risk management results should be communicated to entire organization. Involvement of middle and low level management is as important as support from top management. Risk management processes should be as simple as possible and business language should be used in risk management processes. Incentives for people to involve in risk management activities should be made clear to entire organization. Risk aggregation is very critical in order to understand real risk levels for different organizational levels and functions. Drivers for Risk Management External Requirements: There are numbers of external requirements that organizations need to comply with. Following ones are the most common external requirements stated by the interviewed organizations. o Industry specific regulations o Customer requirements o Market requirements o Third party certification such as ISO and BS Change Management: Changes in business world make most organizations conduct risk assessment activities for their investment decisions. The Risk assessment is not only about financial risk but also about nature of the investment decisions. For example, risk 4

5 assessment results are used to decide on which investment should be prioritised and also to manage the timing of projects and investments. Past Failures: Some organizations stated that their failures in the past made them realize the value of risk management. They learned from their mistakes where risk assessment could have helped them avoid the loss they had to bear. New Business: Most of the organizations conduct risk assessment when there is a new business project such as launching a new product, entering to a new market or opening a new branch. Customer Satisfaction: some organizations use risk management specifically for customer satisfaction. Particularly operational risk management help organizations increase the quality of products and the quality of services. Future Opportunities: Risk management focuses on upside risk as well as downside risk. Therefore one of the outputs of risk management is future opportunities. Conclusion about Risk Management Market Awareness about risk management has increased substantially in the last decade. There is a huge potential of growth in risk management market, which is part of Enterprise Governance Risk and Compliance Market. Macro economic trends such as increase in new regulations, transformation to digital business and easy access to information support the growth of the market. There are some industries advanced than others in risk management. A few of those are banking, insurance and manufacturing particularly in risky areas such as food, healthcare, automotive and aerospace. As the market grows, new challenges arise. Solutions to those challenges need to be industry and organization specific rather than be generic. 5

ISO 9001:2015 Your implementation guide

ISO 9001:2015 Your implementation guide ISO 9001 is the world s most popular management system standard Updated in 2015 to make sure it reflects the needs of modern-day business, ISO 9001 is the world